Critical Infrastructure Assessment Tool - British Columbia

Understanding the ToolGoods & ServicesBoth the Goods & Services sections on the Internal Dependencies and External Dependenciesworksheets include the 10 Critical Infrastructure Sectors recognized by British Columbia and theGovernment of Canada:oEnergy & nformation & CommunicationsTechnologyoHealthoWater & WastewateroSafetyoManufacturingThe list also includes ‘Shelter’ and‘Internal Assets That Are Services’ asadditional sectors.Each of these sectors is further broken down into specific Goods & Services that are reflective ofeach category. The Champion should add any Goods and/or Services they feel are missing prior to theinitial workshop, and delete any that do not apply to the community. If appropriate, the Championshould also change the names of the Goods and Services in order to reflect the terminology that isused locally. There is room on the worksheet to add several items in each category.Participants are responsible for Recommending Goods & Services that should be added/removed fromthe set of Internal Goods & Services that have been proposed by the Champion, as well as recommendingany changes to the set of External Goods & Services.11 Critical Infrastructure Assessment Tool – V2.2

Understanding the ToolStakeholder ImpactsAt the top of the Internal Dependencies worksheet,there is a section that has been included as an optionalstep in the process, where the purpose is to identify thedependencies that specific stakeholder groups(Business & Organizations, Citizens, Local AuthorityOperations, and Other Local Authorities) may have oncommunity Goods & Services.The Champion may engage the Participants inidentifying the specific residents, groups andstakeholders that may be impacted by the loss of aGood/Service. This is a subjective analysis which ismeant to provide some additional information on whichGoods/Services would have an impact if lost.Data Inputs & Dependency TotalsThe majority of both the Internal Dependencies andExternal Dependencies worksheets consist of blank cellsthat intersect between Local Authority Assets and Goods &Services. These cells will be used to record dependenciesthroughout the CI Assessment process:To record a Critical Dependency,the letter “C” will be typed in to the cell.To record an Important Dependency,the letter “i” will be typed in to the cell.To record No Dependency,the cell will be left blank.As you record each dependency, the totals for Criticaldependencies and Important dependencies will be talliedfor both the Local Authority Assets (far right columns) and the Goods & Services (bottom rows).Although the totals produce valuable insight when comparing the dependencies associated with specificAssets and Goods & Services, these totals are intended to be a point of discussion for the Champion andParticipants and should not be considered an authoritative metric for determining the respective criticalityand vulnerabilities of the Assets/Goods & Services. Therefore, it is recommended that additional metricsand dialogue be considered when conducting your analysis and producing recommendations.12 Critical Infrastructure Assessment Tool – V2.2

Instructions for Using the ToolInstructions for Using the ToolOverviewOnce the respective lists of Local Authority Assets and Goods & Services have been establishedand a “Master Copy” of the CI Assessment Tool has been produced, the Champion will guideParticipants through the completion of the worksheets. Although the process is designed to be flexibleto meet the needs of the Champion and Participants, the key tasks can be organized as follows:1.2.3.4.5.Define ResponsibilitiesSchedule Time to Complete the WorksheetsComplete the Internal Dependencies WorksheetComplete the External Dependencies WorksheetAssess Results and Produce RecommendationsTask 1: Define ResponsibilitiesPrior to beginning the completion of the worksheets, the Champion should ensure that each Participant isaware of the specific set of Local Authority Assets and/or Goods & Services that they and the otherParticipants will be responsible for completing, so as to ensure appropriate coordination and collaborationthroughout the process.Participants are responsible for Communicating to the Champion which Assets and/or Goods &Services they should be responsible for based on their expertise/day-to-day responsibilities.Task 2: Schedule Time to Complete the WorksheetsOnce you are aware of what sections of the worksheets you will be responsible before, you can schedule timeto complete the worksheets. It typically takes 1-2 hours to complete your department or agency’s portion ofthe worksheet, but this is likely to change depending on each Participant’s respective responsibilities. TheChampion will determine whether you will be completing the Tool: During the initial workshop;Following the initial workshop as “homework”; orA combination of during and following the initial workshop.You may find it useful to invite/consult with some of your coworkers to help with this task, and some outreachto other stakeholders/departments may be necessary in order to produce accurate results.Participants are responsible for Determining how much time they will need to accurately complete theirrespective sections for both worksheets, and communicating their needs/expectations to the Champion forplanning purposes.13 Critical Infrastructure Assessment Tool – V2.2

Instructions for Using the ToolTask 3: Complete the Internal Dependencies WorksheetAs stated previously, the Internal Dependencies worksheet is intended to identify which LocalAuthority Assets are Critical or Important for providing specific Internal Goods & Services in thegiven scenario. When working on the Internal Dependencies worksheet, you should ask the question:“What local Assets do we need to offer these Goods & Services?”Also mentioned previously, the process was developed with the intention of requiring minimaltechnical expertise in terms of operating the CI Assessment Tool. However, if an issue arises whileusing the Tool, visit the “Troubleshooting Instructions” section of this guide, or request assistancefrom the Champion.Participants are responsible for completing the following process First, revisit the definitions for Critical and Important (both definitions are also listed at the top ofthe worksheet). Next, decide whether it is more appropriate for you and those you will be conducting theassessment with to start by focusing on a particular Good & Service or start by focusing on aspecific Asset:14 Critical Infrastructure Assessment Tool – V2.2

Instructions for Using the Tool Once you have decided upon a particular method, begin identifying the dependencies that existbetween your community’s Assets and the list of Internal Goods & Services until you haveconcluded the sections of the worksheet you are responsible for. There are three options andrespective actions to describe dependencies within the worksheet:1. Critical Dependency:Type the letter “C” into the cell.2. Important Dependency:Type the letter “i” into the cell.3. No Dependency:Leave the cell blank. Contextual information and key factors that were used to determine why a dependency was consideredto be Important or Critical should be added to the Parking Lot worksheet. After completing the assessment of the Assets and/or Goods & Services that you are responsible for,you should review the results to ensure that they are accurate. Finally, “Save” the file and move on to the External Dependencies worksheet.15 Critical Infrastructure Assessment Tool – V2.2

Instructions for Using the ToolTask 4: Complete the External Dependencies WorksheetThe External Dependencies worksheet is intended to identify which externally provided Goods &Services are Critical or Important to your community’s Assets in the given scenario. When workingon the External Dependencies worksheet, you should ask the question:“What external Goods & Services do our community’s Assets rely on?”This is the key difference between the External Dependencies worksheet and the InternalDependencies worksheet; otherwise, the process for assessing and recording data is very similar.However, prior to conducting the assessment, the Champion and Participants should confirm thatthe External Dependencies worksheet has been updated with any new Assets that were included onthe Internal Dependencies worksheet so that the two lists are identical. Once this has beenconfirmed, the Participants can carry on with their responsibilities.Participants are responsible for completing the following process: Revisit the definitions for Critical and Important (both definitions are also listed at the top of thespreadsheet). Next, decide whether it is more appropriate for you and those you will be conducting theassessment with to start by focusing on a particular Good & Service or start by focusing on aspecific Asset. Once you have decided upon a particular method, begin identifying the dependencies that existbetween your community’s Assets and the list of External Goods & Services until you haveconcluded the sections of the worksheet you are responsible for. There are three options andrespective actions to describe dependencies within the worksheet:1. Critical Dependency:2. Important Dependency:3. No Dependency:Type the letter “C” into the cell.Type the letter “i” into the cell.Leave the cell blank. Contextual information and key factors that were used to determine why a dependency was consideredto be “Important” or “Critical” should be added to the Parking Lot worksheet. After completing the assessment of the Assets and/or Goods & Services that you are responsible for,you should review the results to ensure that they are accurate. Finally, “Save” the file and return the completed version to the Champion so that they can aggregate theresults produced by other Participants.16 Critical Infrastructure Assessment Tool – V2.2

Instructions for Using the ToolTask 5: Assessment Results and RecommendationsOnce the worksheets have been completed, the Champion and Participants will need to identify atleast 4-5 recommendations related to the results of the assessment in a summary report.Importantly, this assessment will be qualitative in that it is based primarily on Participants’interpretation of the CI Assessment Tool and its outputs. While an Asset may have a highnumber of dependencies, it is important to note that this does not necessarily mean the Assetis more or less critical than another. Rather, the relative criticality should be determinedthrough discussion.Once the data has been analyzed, the community Champion will then generate a summary report. Thereport will include a review of the findings as well as proposed actions that will be taken to address themanagement of “top priority” assets in context of the four pillars of emergency management. The reportmay provide specific planning decisions that need to be incorporated into planning efforts or it maypresent questions that should be addressed in future planning, such as:Mitigation:What financial & resource planning is required to support this Asset? Are theresteps that can be taken to mitigate damage or loss in a future event?Preparation:What resources can be allocated to back-up or serve as a contingency in the eventthe Asset fails/is damaged/is unavailable?Response:What activities need to be performed to protect the Asset during an emergency? Toassess damage to the Asset? To determine the length and extent of outages shouldthe Asset be unavailable?Recovery:If damaged or destroyed, should the Asset be fixed? Replaced? Replaced withanother option?The report is not intended to be a large document. Rather, it is meant to provide a high level overviewof the process so far and the actions that may be taken to address top priority assets.Once completed, the report will be provided to workshop Participants and other stakeholders forreview and comment. Following any revisions, this report can be used for community planning anddecision making.17 Critical Infrastructure Assessment Tool – V2.2

Troubleshooting InstructionsTroubleshooting InstructionsIssueSolutionI can’t decide if an asset is Critical or Important.Err on the side of caution and indicate it is Critical.We use one asset all the time but have twobackups. I’m not sure which one is Critical.Check with the community Champion/facilitator toidentify whether the primary Assets or the backupsare considered Critical.One of our community Assets can also beconsidered a service. For example, thecommunity website is both an asset but providesa service community.Include the Asset in the Internal Assets that areServices column at the far left of the InternalDependencies worksheet.One of our community Services is a contractedService. For example, the community is requiredto provide a Police Service. These Services arecontracted from the RCMP.First, add the Service to the Internal Goods &Services row on the Internal Dependenciesworksheet. You do not need to identify any assetsfor this service.Then, add the Service to the Internal ServicesDirectly Supported By External Services section onthe External Dependencies worksheet. Put a C inthe column of the Service provider (such as thePolice).One of our community-owned Assets is onlyCritical during an actual emergency. Forexample, the community has a large empty field.During a flood or earthquake, this field would beused as a staging area.Add this Asset to the Local Authority Assets List.One of our community Assets relies on aninternally offered Service. For example, Policeand Fire personnel use a specific model of radio.The maintenance of these radios is offeredinternally by our I.T. department.Include the Service in the Internally ProvidedServices column at the far left of the ExternalDependencies spreadsheet.One of our Services relies on other internallyoffered Services. For example, a number of ourServices rely on the GIS Services – an internalService.First, include the Service on in the Internal Servicesthat Support Internal Services column at the far leftof the External Dependencies spreadsheet.Then, add the Services that rely on this Service tothe Internal Services Directly Supported By ExternalServices section on the External Dependenciesworksheet.18 Critical Infrastructure Assessment Tool – V2.2

Troubleshooting InstructionsOne of our Assets is co-owned with anothercommunity. For example, the Police Station isco-owned with a neighbouring community. Bothcommunities have 50% ownership.Add the Asset to the Local Authority Assets List.We own an Asset but it is managed by a differentgroup or agency. For example, the communityowns a building but it is managed by an externalcompany.Add the Asset to the Local Authority Assets List.We don’t own an Asset but have an agreementto access it during an emergency. For example,the community has an agreement to use a localbusiness’ offices in the event the EmergencyOperations centre is unavailable.Add the Asset to the Local Authority Assets List.When consolidating the worksheets, twodepartments have reviewed the same Service.One department rated a dependency asImportant; the second department rated thesame dependency as Critical.Indicate the dependency is Critical. Make a note ofthe two ratings in the Parking Lot.When consolidating the worksheets, twodepartments have reviewed the same Service.Both departments have listed a dependency asCritical.Indicate the dependency is Critical with a single C.Make a note of the two ratings in the Parking Lot.19 Critical Infrastructure Assessment Tool – V2.2

Understanding the Tool 9 Critical Infrastructure Assessment Tool - V2.2 Hazard Scenario During the CI Assessment process, the Champion will lead the selection and crafting of a hazard scenario based off of your community's Hazard Risk Vulnerability Assessment (HRVA), which should produce a clear answer to relevant questions such as: